CVE-2016-7040

CWE-284 — Improper Access ControlCWE-20 — Improper Input Validation5 documents5 sources
Severity
8.8HIGH
EPSS
0.6%
top 29.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Cloudforms Management Engine
Timeline
PublishedOct 7
Latest updateMay 17

Description

Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter collections.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-7fr4-2q4f-xgw5: Red Hat CloudForms Management Engine 4↗2022-05-17
▶
CVEList
CVE-2016-7040: Red Hat CloudForms Management Engine 4↗2016-10-07
▶

📋Vendor Advisories

1
Red Hat
cfme: Incorrect sanitization in regular expression engine↗2016-10-04
▶

💬Community

1
Bugzilla
CVE-2016-7040 cfme: Incorrect sanitization in regular expression engine↗2016-09-12
▶
CVE-2016-7040 (HIGH CVSS 8.8) | Red Hat CloudForms Management Engin | cvebase.io